TISAX or ISO 27001: what do suppliers really need?
Updated: 2026-11
If you work with confidential data for vehicle manufacturers, you usually need TISAX, because the manufacturers require it. ISO 27001 is the broader standard for all other customers and sectors. Both rest on the same principles, and a well-built ISMS can serve both.
TISAX is the automotive industry’s assessment and exchange mechanism; ISO 27001 is the international standard for information security management systems. Their content overlaps heavily, because the TISAX catalogue is based on ISO 27001.
The choice therefore depends less on technology than on your customers.
Head to head
| Criterion | TISAX | ISO 27001 |
|---|---|---|
| Purpose | Evidence for the automotive industry | Sector-neutral evidence of an ISMS |
| Result | Labels shared via the ENX platform | Certificate from an accredited body |
| Content | VDA ISA catalogue including prototype protection | Requirements of the standard and Annex A |
| Validity | Usually three years | Three years with annual surveillance |
| Acceptance | Mandatory for many vehicle manufacturers | Widely recognised across sectors |
| Combination | Can build on an ISO 27001 ISMS | Good foundation for later TISAX |
When TISAX wins
- —Vehicle manufacturers or large suppliers require a specific TISAX label.
- —You work with prototypes or highly confidential development data.
- —Your business is predominantly automotive.
When ISO 27001 wins
- —Your customers come from many sectors.
- —Tenders or customers require an ISO certificate.
- —You want a foundation that can later carry TISAX too.
Our take
For automotive suppliers, TISAX is usually unavoidable. An ISMS structured to ISO 27001 from the start makes it easier to provide both.
For everyone else, ISO 27001 is the natural standard. Neither is legally required for NIS2, but both ease evidence.
Parent service: Cyber readiness & IT security
Matching offers
Building an ISMS to ISO 27001
An ISO 27001 ISMS is the solid foundation for NIS2, TISAX, customer requirements and possible certification. We build it to fit your company: scope, risk assessment, statement of applicability, policies, responsibilities and internal audit. The certification audit is carried out by an accredited body.
Compliance assessment for companies
The compliance assessment establishes in one pass which regulations apply to your company, from data protection to the AI Act, NIS2 and the Swiss ISA, the Data Act, accessibility and e-invoicing. You receive a reason for each regulation, a risk and deadline rating for each gap and, at the end, an action plan.
FAQ
Does TISAX replace ISO 27001 certification?
No. Outside the automotive industry TISAX is rarely requested, and other customers’ ISO requirements remain.
Can both be prepared at the same time?
Yes. A shared ISMS with additions for TISAX-specific requirements is the most efficient route.